CVE-2017-6042 Cross-site request forgery in Sierra Wireless AirLink Raven XE and XT
Attackers can trick authenticated users into performing unintended actions on Sierra Wireless AirLink devices due to missing CSRF protections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2017-6042?
CVE-2017-6042 is a high-severity vulnerability in Sierra Wireless AirLink Raven XE and XT, published on 30 Jun 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A Cross-Site Request Forgery issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Affected devices do not verify if a request was intentionally sent by the logged-in user, which may allow an attacker to trick a client into making an unintentional request to the web server that will be treated as an authentic request.
Weakness: CWE-352
Which versions are affected by CVE-2017-6042?
It affects 2 products.
Products include Sierra Wireless Airlink Raven Xe Firmware, Sierra Wireless Airlink Raven Xt Firmware.
How do I fix CVE-2017-6042?
No fix has been published for CVE-2017-6042 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-6042 being exploited?
There is no known exploitation of CVE-2017-6042 in the wild and no public exploit code.
Other vulnerabilities in Sierra Wireless AirLink Raven XE and XT
Sources
Also known as GHSA-wp73-m8wc-m2mm.